# $Id: Deamons.pm 36 2006-09-29 23:09:30Z cmauch $
#
# Author: Charles Mauch (cmauch@gmail.com)
# Description: Module to handle email sent from a daemon and file corretly
# Legal: (c) 2006 Charles Mauch, released under the terms of the GPLv2 or later

# -- [ sub: Daemons ] -------------------------------------------------------
#
#Summary:      Subroutine to check for administrative emails and file them
#              away.
#Parameters:   email address, full username, subject of email
#Return:       none

sub CheckDaemons {
    my ( $address, $username, $subject ) = @_;

    # The Mailer Daemon, I'm sure there are much more inclusive regexps
    # but this works for most of my errors.
    if ( ( $address =~ /.*MAILER-DAEMON/ ) || ( $username =~ /.*Mail\sDelivery\sSubsystem/ ) ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "admin\/bounces/" );
        $item->accept( "$MauchConfig::maildir/admin/bounces" );
    }

    # Catch Logcheck Reports
    if ( $address =~ /logcheck+\@mauch+\.name/ ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "admin\/logcheck/" );
        $item->accept( "$MauchConfig::maildir/admin/logcheck" );
    }

    # Catch Integrit (tripwire) reports
    if ( ( $address =~ /root+\@.*/ ) && ( $subject =~ /.*integrit/ ) ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "admin\/integrit/" );
        $item->accept( "$MauchConfig::maildir/admin/integrit" );
    }

    # Catch Cricket Reports and send to oblivion
    if ( ( $address =~ /root+\@.*/ ) && ( $subject =~ /.*Cron\s\<cricket\@iserver\>/ ) ) {
        $item->accept( "$MauchConfig::maildir/admin/cricket" );
    }

    # Catch Cron reports
    if ( ( $address =~ /root+\@.*/ ) && ( $subject =~ /.*Cron/ ) ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "admin\/cron/" );
        $item->accept( "$MauchConfig::maildir/admin/cron" );
    }

    # Catch Cron reports
    if ( ( $address =~ /root+\@.*/ ) && ( $subject =~ /.*fcron/ ) ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "admin\/cron/" );
        $item->accept( "$MauchConfig::maildir/admin/cron" );
    }

    # We hate out of office announcements.  Just nuke em.
    if ( $subject =~ /^Out\sof\sOffice.*/ ) {
        Logger( $epochtime, $score, "other", $username, $address, $subject, "dev/null" );
        $item->accept( "/dev/null" );
    }

    # Misc Oddities, Cryptogram, not sure what list-serv he uses.
    if ( $address =~ /schneier+\@COUNTERPANE+\.COM/ ) {
        my $listname = $address;
        Logger( $epochtime, $score, "lists", $username, $address, $subject, "lists\/$listname/" );
        $listname = getlistname( $listname );
        $item->accept( "$MauchConfig::maildir/lists/$listname" );
    }
} ## end sub CheckDaemons

1;
